Protection failure in generative-ai lets attackers skip human approval for remote code execution and topology tampering
An attacker can abuse a self-approval flaw in the Tier 2 topology-mutation logic and modify the multi-agent graph without a real SRE token. Through a module attribute-traversal flaw allowed inside the APEX sandbox, the attacker reaches the os and sys modules indirectly via threading._sys and runs arbitrary system commands. The issue comes from missing dual-control verification and insufficient static AST checks, so untrusted synthesized code can escape the isolated environment, fully control the server, and maliciously alter the system topology.
Component
generative-ai is a generative-AI application framework built on Google Cloud Platform. Its layered autonomous structure and human-in-the-loop (HITL) gates are meant to evolve and govern multi-agent systems safely. The component coordinates complex multi-agent topology changes and manages the lifecycle from code synthesis to environment deployment, keeping critical human intervention points in automated decisions so integrity and compliance hold.
Enforce strict dual-control authentication so the approver and the requester are different entities, introduce read-only module proxy objects that limit sandbox access to private attributes and low-level system modules, and do not expose full standard-library references inside dynamic code-execution environments, blocking potential privilege-escalation paths.
CSSA Exclusive Early Warning
10.0 Critical
The ai-memory PowerShell component fails to reject HTTP redirects, leaking sensitive credentials and polluting session data
An attacker can stand up a malicious endpoint that returns 302, 307, or 308 and abuse the PowerShell script's default of following redirects. On a redirect, the script injects the follow-up response into the session context, or wrongly treats a non-success status as a successful delivery and deletes pending events. If the target is a login or phishing page, a static authorization token can be sent in the POST body to a third-party server, leaking credentials, and the adversary can tamper with session handoff data, damaging integrity and confidentiality.
Component
ai-memory is an open-source library that gives AI agents context-memory management. Its core includes a native hook client and bindings in multiple languages, using a standard interface to persist events and synchronize state. The system relies on network transport to exchange critical metadata between agents and backend services so information stays coherent across multi-turn conversations and business logic stays consistent.
When issuing HTTP requests, explicitly disable automatic redirect following so a 3xx status stops the connection immediately and marks the task failed. Also distinguish a real success response from a redirect in status-code checks, so sensitive data is not sent out by accident and internal state is not cleared incorrectly.
CVE Intelligence
2
CVE-2026-4052
CVSS
9.8 Critical
2026-11-03
Missing authorization in WSO2 Identity Server allows unauthorized access to system APIs
In deployments where WSO2 Identity Server is configured as the Resident Key Manager with database sharing enabled, authorization is missing (CWE-862). A self-registered user may obtain a token from the WSO2 Identity Server token endpoint and then illegally access the System REST APIs of WSO2 API Manager. Every WSO2 deployment that uses this specific configuration without extra access control is affected. An attacker only needs to register an ordinary user account to trigger the flaw, with no complex interaction, and can exploit it remotely.
Component
WSO2 Identity Server is an open-source identity and access management solution commonly used for enterprise authentication, authorization, and key management.
Risks
From ordinary user to administrator: If the victim runs the browser with administrator privileges, the attacker can obtain the same privileges
Complete system control: Attackers can run arbitrary code on the victim system and, depending on the user's privileges, install programs, view/change/delete data, or create new accounts with full privileges
No-user-interaction attack: Using drive-by compromise (T1189), a user only needs to visit a malicious web page to trigger the flaw, with no further interaction
Enable sandbox isolation for the runtime environment
Block Canvas script loads from untrusted sources
CVE-2026-63470
CVSS
9.8 Critical
2026-11-04
Code injection in fastapi-code-generator enables remote code execution
Before fastapi-code-generator 0.8.1, the tool improperly controls generated code (CWE-94) when it builds a FastAPI application from an OpenAPI file. The generator inserts Operation.summary into the generated route-handler docstring as a triple-quoted string and does not escape embedded triple quotes. An attacker-controlled or attacker-influenced operation summary can close the docstring and inject valid Python expression statements into the handler body. Input that only breaks syntax causes generation to fail, but syntactically valid generated code runs with the server process's privileges when the affected route handler is called. Every user who generates code with fastapi-code-generator before 0.8.1 is affected. An attacker can craft a malicious OpenAPI file, induce a developer to generate an application that contains the malicious code, and achieve remote code execution when that application runs and the affected route is called.
Component
fastapi-code-generator is a tool that automatically generates FastAPI applications from OpenAPI files in order to simplify API development.
Risks
Complete system control: Attackers can run arbitrary Python code in the server process context and fully control the server
Privilege escalation: Injected code runs with the server process's privileges, so a highly privileged server yields the corresponding system privileges
Remote code execution: No user interaction is required; once the generated code is deployed and the affected route is called, the malicious code runs
Upgrade fastapi-code-generator to 0.8.1 or later immediately
Review code generated by older versions and check route handlers for unexpected Python expressions
Strictly validate OpenAPI input sources so fields such as Operation.summary do not contain malicious characters
Package Poisoning
10
Package Poisoning
npm2026-11-04
9ct8bi@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
3ef51b9a54bd574e3b6d9ba198d4c9b1
Package Poisoning
npm2026-11-04
k7nhgj@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
b7789923ace8e86aedb12cac10811413
Package Poisoning
npm
rtvu6h@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
a59da8723b
Package Poisoning
npm2026-11-04
ru0z83@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
eb27d0f4da6027132e2323493e0b2b15
Package Poisoning
npm2026-11-04
t6unrv@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
b46a157972547f9ded5c772627f05584
Package Poisoning
npm2026-11-04
u0bh1f@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
9c73b3e711fc161a5a5e93696dae442e
Package Poisoning
npm2026-11-04
updated-gen-erator-carx-drift-racing-h-a-c-k-gen-erat-or-tkfm7v@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
830d69be3dc5753d60037d4dad30a9aa
Package Poisoning
npm2026-11-04
updated-today-gen-photo-lab-pro-h-a-c-k-gen-erat-or-ofgpju@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
8767ca94f42b5fd8ea4f230ae4ddc786
Package Poisoning
npm2026-11-04
yhk9j0@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
14f7a2b879f279850fd65ab7c67f80ec
Package Poisoning
gem2026-11-04
w002yardprobe@0.0.4
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
